High severity · published Sep 15, 2021
CVE-2021-40155
A maliciously crafted DWG file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to read beyond allocated boundaries when parsing the DWG files
7.8
CVSS
1%
EPSS
No
On KEV
Description
A maliciously crafted DWG file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to read beyond allocated boundaries when parsing the DWG files. This vulnerability can be exploited to execute arbitrary code.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NA
Navisworks · Autodesk
2019; 2020; 2021; 2022 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-40155
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-40155
Vendor Advisory
https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0009
More from Navisworks
7.8
CVE-2025-1660
DWFX File Parsing Memory Corruption Vulnerability
7.8
CVE-2025-1659
DWFX File Parsing Out-of-Bounds Read Vulnerability
7.8
CVE-2025-1658
DWFX File Parsing Out-of-Bounds Read Vulnerability
7.8
CVE-2024-12671
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability
7.8
CVE-2024-12670
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability